Knowledge Base::DBSA:2014-0009

Views

Disclaimer: as technology changes, advisories may become out of date or may no longer be relevant, please refer to the "Date" section of the header to be sure the advisory is recent as pertains to your situation.

Classification

Rationale: Continued Use of Internet Explorer may open users up to various security incidents

Severity: HIGH

Rationale: Due to Internet Explorer's integration into Windows, it is deemed that Internet Explorer is too sensitive to expose to the Internet

Spread of Issue: SINGLE-PLATFORM HIGH

Rationale: Affects a large market share of web browser users

Description

Internet Explorer is a web browser software package released by Microsoft, typically bundled with Windows. Recently there has been a 0day released where Internet Explorer versions 6.0 through 11.0 installations may be tricked into executing code from a remote server. This vulnerability permits an attacker to corrupt the browser's memory range where the dropped data may be pushed into executable memory thus executing that injected code. Internet Explorer is heavily integrated into Windows and thus is a potentially sensitive component.

Internet Explorer is an add-on to Windows without direct support and thus doesn't have enough of a security backing to be properly secured by the vendor. This is made apparent by the continued existence of ActiveX and the ongoing integration by the vendor into Windows that places users at risk.

Mitigation/Solution

It is strongly advised to stop usage of Internet Explorer and migrate to another browser platform such as Mozilla Firefox, Opera or a similar browser due to the security history of the browser.

Corporate web application developers are strongly advised to refactor their applications to work under alternate browsers, where cases that this isn't possible, system administrators are advised to lock down Internet Explorer and forbid installations to access the Internet while using it solely for these applications while continuing use of alternate browsers for such use.